Risk Exposure Management

    Risk Exposure Management Risk Visualization Risk Exposure Queries

    Risk Exposure Management provides a centralized, visual representation of accounts with access to sensitive and highly privileged entities within your Active Directory (AD) environment.

    By monitoring over-permissioned identities and evaluating potential threat paths, the product displays your organization's exposure to internal and external attacks. It equips you with detailed insights into why an entity is considered exposed and what can be done to mitigate the associated risks.

    With this capability, the product helps you understand the scope of privilege exposure, evaluate the risk it poses, and implement effective remediation measures, strengthening your IT environment's security and resilience.

    In this document, you will learn the following:

    Understand the key terms

    Here are some terms that are important to understand:

    Term Description
    Privileged Entities AD groups with elevated permissions that provide access to sensitive resources
    Privileged Entities Exposure Security risks that arise from excessive or misconfigured privileges for critical entities
    Attack Path A continuous flow of connected entities representing a potential route an attacker can take to compromise the target
    Accounts in Attack Path Accounts through which the attacker can traverse to move laterally toward the target
    Attack Flow A sequential path showing how the attacker can progress through the environment
    Parent The preceding object in the attack path that enables access to the next entity
    Relation The type of privilege or trust that connects two objects in the attack path

    Steps to analyze risk exposure

    1. Navigate to Governance > Risk Management > Risk Exposure Management.
    2. From the Select Domain drop-down, choose the domain you wish to analyze for risk exposure. A dashboard will then display the count of configured Privileged Entities along with the associated attack paths.
    3. Under Attack Paths, you can view the potential attack paths that lead from an initial access point to a privileged entity.
    4. Under Privileged Entities Exposure, you can view the list of all privileged entities along with the potential attack paths that could be exploited to compromise them.

      Note: By default, built-in AD groups are listed as privileged entities in the product. To add other groups as privileged entities, follow the steps in this help document.

    5. Under Impact Radius, you can view the list of all the objects that could be affected if a privileged entity is attacked.
    6. Click the refresh icon in the top-right corner to update the attack paths of privileged entities in the selected domain.
    7. Click Set Data Sync Time to configure the schedule for automatic data synchronization.

    Privileges and permissions are often interconnected across users, groups, computers, and other AD objects within the environment. The product maps these relationships using an attack flow graph, enabling the identification of control paths and potential routes that could lead to privilege escalation or domain compromise.

    AD privilege relationships and escalation paths.
    An attack flow graph showing key AD privilege relationships and possible escalation paths.

    Understanding attack path relations and views

    Each connection between nodes shows how permissions and control flow within the environment. These relationships support legitimate administrative activities, but when access is overly permissive or misconfigured, they can create unintended privilege paths. Such paths may be exploited to move across systems or gain elevated access.

    Examining such connections enables administrators to identify indirect control chains, understand their potential impacts, and take steps to reduce security risks:

    • Click any object to view its properties.
    • Click any relation line to view detailed information about it, including a description, exploitation methods, and recommended remediation steps. The recommended remediation steps can be performed in the product through the Change Owner, Remove Membership, and Remove Permission management tasks.
    • Graphs can be displayed in either a Consolidated View or a List View, depending on your requirements:
      • Consolidated View: This displays the complete attack flow graph, including all related objects. This is the default view.
      • List View: This displays individual attack flow graphs between the target and related objects. The results can be filtered based on the Intermediate Object and Relations using the Filters option.

      Note: The Consolidated View and List View are available only for Attack Paths and Privileged Entities Exposure graphs.

    Use case: How can an attacker gain administrative privileges through a user?

    During a routine security review, administrators discovered that sensitive sales and financial data had been accessed using Sales Managers group privileges. However, the user involved—Daniel—was not listed as a member of any highly privileged group, and there was no direct evidence linking him to the Sales Managers group.

    Risk Visualization/Attack Flow

    Using Risk Exposure Management, the team visualized hidden privilege paths:

    • Daniel had indirect access to the Sales Managers group through a chain of nested group relationships and delegated permissions:
      • Daniel was a member of the Technicians group, which had Generic Write permission over Arnold's account.
      • Arnold, in turn, was a member of Sales Managers.
    • By exploiting this chain, Daniel could impersonate Arnold or modify group memberships, granting himself elevated access without being directly added to the Sales Managers group.

    The hidden chain of group memberships and delegated permissions created an unnoticed privilege escalation path, allowing Daniel or anyone with access to his account to gain domain-level control. By leveraging Risk Exposure Management, the administrators were able to trace and eliminate these indirect attack paths, mitigating the risk before any further damage could occur.

    Legends

    The Legends pop-up helps administrators understand the attack flow by explaining the object categories by their color, the node types, and the meaning of relations.

    Object types

    Symbol Object type
    icon User User
    icon group Group
    icon computer Computer
    icon AD Other AD Objects

    Node types

    Symbol Node type Description
    icon target Target A high-value target object that could be a potential goal of an attacker
    icon Entry Point Entry Point The initial object from where the attack path begins
    icon Cluster Cluster A group of related nodes, collapsed to reduce visual clutter

    Relation types

    Symbol Relation type Description
    icon Cluster MemberOf Represents a group membership, indicating that the object is a member of another group
    icon Owns Owns Represents ownership of one object over another object.
    icon Cluster Other Permissions Represents other delegated permissions, such as write, read, or special control rights

    List of relations

    The attack flow visualizes the following relation types, each representing a potential privilege flow or attack path that could be leveraged within the AD environment.

    • Member Of
    • Owns
    • Write DACL
    • DCSync
    • Allowed To Act
    • Grant Allowed To Act
    • Add Key Credential
    • Reset Password
    • Write Owner
    • Generic All
    • Write SPN
    • Extended Rights
    • Allowed To Delegate
    • Has SID History
    • RODC Manage
    • Generic Write
    • Add Member
    • Domain Trust

    Risk Exposure Query provides a comprehensive set of predefined queries designed to identify common security exposures and permission risks within your AD environment. Each query result includes a visual representation of objects and their relations, enabling administrators to understand and address privilege-related risks.

    other AD entities, including nested memberships and trust paths. By mapping these connections, the product helps identify potential exploitation paths that attackers could use for privilege escalation or lateral movement. Each query is also accompanied by actionable remediation measures that guide administrators on the necessary actions to be taken to mitigate risks and strengthen the overall AD security posture.

    Queries available in ADManager Plus

    Find All Domain Admins

    Identify all members of the Domain Admins group, including those in nested groups, to gain complete visibility into who has top-tier privileges in your domain.

    Map Domain Trusts

    Identify and analyze all domain trust relationships within the forest and understand how domains trust each other and evaluate potential cross-domain attack surfaces.

    Find Kerberoastable Members of Privileged Groups

    Identify privileged group members vulnerable to Kerberoasting attacks and mitigate risk by pinpointing accounts that expose high-value targets.

    Path from Kerberoastable Users to Privileged Entities

    Trace attack paths from Kerberoastable users to privileged accounts or groups and uncover lateral movement opportunities before attackers do.

    Find Security Principals with DCSync Rights

    Identify accounts or groups with permissions to replicate domain controller data and prevent potential abuse that could lead to domain-wide compromise.

    Path from Domain Users to Privileged Entities

    Detect how standard domain users could escalate privileges and assess privilege escalation risks based on current configurations.

    Path to Unconstrained Delegation Systems

    Find paths to systems vulnerable to unconstrained delegation attacks and Address delegation misconfigurations that might lead to credential theft.

    Path to Kerberoastable Users

    Identify how attackers could reach users vulnerable to Kerberoasting, and reveal and remediate weak links in your security chain.

    Find Path to Domain Admins

    Detect potential attack paths leading to the Domain Admins group and harden your domain by closing escalation paths to critical roles.